test: add comprehensive test suite - 5 test files, 65% coverage

- cli_test.go: 10 tests for list/search/extract/download commands
- serve_test.go: 11 tests for HTTP handlers and SSE progress
- http_test.go: 5 subtests for archive.org API
- download_test.go: 10 tests for download logic
- util_test.go: 7 tests for string/util helpers

Error paths covered: server errors, empty results, download failures,
extract failures, missing identifiers, ReadDir errors.

golangci-lint: 0 issues, go vet: clean

serve.go

@@ -189,7 +189,10 @@ func handleAPIDownload(w http.ResponseWriter, r *http.Request) {
 		jobIDs = append(jobIDs, jobID)
 
 		go func(j downloadJob, s *downloadState) {
-			os.MkdirAll(filepath.Dir(j.OutPath), 0755)
+			if err := os.MkdirAll(filepath.Dir(j.OutPath), 0755); err != nil {
+				s.Error = err.Error()
+				return
+			}
 
 			client := &http.Client{Timeout: 0}
 			req, _ := http.NewRequest("GET", j.URL, nil)
@@ -206,20 +209,23 @@ func handleAPIDownload(w http.ResponseWriter, r *http.Request) {
 				s.Error = err.Error()
 				return
 			}
-			defer resp.Body.Close()
+			defer func() { _ = resp.Body.Close() }()
 
 			outFile, err := os.Create(j.OutPath)
 			if err != nil {
 				s.Error = err.Error()
 				return
 			}
-			defer outFile.Close()
+			defer func() { _ = outFile.Close() }()
 
 			buf := make([]byte, 32*1024)
 			for {
 				n, readErr := resp.Body.Read(buf)
 				if n > 0 {
-					outFile.Write(buf[:n])
+					if _, err := outFile.Write(buf[:n]); err != nil {
+						s.Error = err.Error()
+						return
+					}
 					s.Downloaded += int64(n)
 
 					now := time.Now()
@@ -267,7 +273,9 @@ func handleProgress(w http.ResponseWriter, r *http.Request) {
 		data, _ := json.Marshal(downloadJobs)
 		downloadJobsMu.Unlock()
 
-		fmt.Fprintf(w, "data: %s\n\n", data)
+		if _, err := fmt.Fprintf(w, "data: %s\n\n", data); err != nil {
+			return
+		}
 		flusher.Flush()
 
 		allDone := true
@@ -331,13 +339,16 @@ func handleAPIExtract(w http.ResponseWriter, r *http.Request) {
 func writeJSON(w http.ResponseWriter, v any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("Access-Control-Allow-Origin", "*")
-	json.NewEncoder(w).Encode(v)
+	if err := json.NewEncoder(w).Encode(v); err != nil {
+		// client disconnected, nothing we can do
+		return
+	}
 }
 
 func openURL(rawURL string) {
-	exec.Command("xdg-open", rawURL).Start()
-	exec.Command("open", rawURL).Start()
-	exec.Command("rundll32", "url.dll,FileProtocolHandler", rawURL).Start()
+	_ = exec.Command("xdg-open", rawURL).Start()
+	_ = exec.Command("open", rawURL).Start()
+	_ = exec.Command("rundll32", "url.dll,FileProtocolHandler", rawURL).Start()
 }
 
 func init() {